# Should NOT be set:
# nokaslr
# rodata=off
+# sysrq_always_enabled
# arm64.nobti
# arm64.nopauth
# arm64.nomte
import json
from .__about__ import __version__
-TYPES_OF_CHECKS = ('kconfig', 'version')
+SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline')
class OptCheck:
# Constructor without the 'expected' parameter is for option presence checks (any value is OK)
if with_results:
print('| {}'.format(self.result), end='')
+ def json_dump(self, with_results):
+ dump = [self.name, self.type, self.expected, self.decision, self.reason]
+ if with_results:
+ dump.append(self.result)
+ return dump
+
class KconfigCheck(OptCheck):
def __init__(self, *args, **kwargs):
def type(self):
return 'kconfig'
- def json_dump(self, with_results):
- dump = [self.name, self.type, self.expected, self.decision, self.reason]
- if with_results:
- dump.append(self.result)
- return dump
+
+class CmdlineCheck(OptCheck):
+ @property
+ def type(self):
+ return 'cmdline'
class VersionCheck:
sys.exit('[!] ERROR: empty {} check'.format(self.__class__.__name__))
if len(self.opts) == 1:
sys.exit('[!] ERROR: useless {} check'.format(self.__class__.__name__))
- if not isinstance(opts[0], KconfigCheck):
+ if not isinstance(opts[0], KconfigCheck) and not isinstance(opts[0], CmdlineCheck):
sys.exit('[!] ERROR: invalid {} check: {}'.format(self.__class__.__name__, opts))
self.result = None
# l += [KconfigCheck('feature_test', 'my', 'LKDTM', 'm')] # only for debugging!
+def add_cmdline_checks(l, arch):
+ # Calling the CmdlineCheck class constructor:
+ # CmdlineCheck(reason, decision, name, expected)
+
+ l += [CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'on')]
+ # TODO: add other
+
+
def print_unknown_options(checklist, parsed_options):
known_options = []
def populate_simple_opt_with_data(opt, data, data_type):
if opt.type == 'complex':
sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt)))
- if opt.type not in TYPES_OF_CHECKS:
+ if opt.type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name))
- if data_type not in TYPES_OF_CHECKS:
+ if data_type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type))
if data_type != opt.type:
return
- if data_type == 'kconfig':
+ if data_type in ('kconfig', 'cmdline'):
opt.state = data.get(opt.name, None)
elif data_type == 'version':
opt.ver = data
else:
populate_simple_opt_with_data(o, data, data_type)
else:
- if opt.type != 'kconfig':
+ if opt.type not in ('kconfig', 'cmdline'):
sys.exit('[!] ERROR: bad type "{}" for a simple check {}'.format(opt.type, opt.name))
populate_simple_opt_with_data(opt, data, data_type)
parsed_options[option] = value
+def parse_cmdline_file(parsed_options, fname):
+ with open(fname, 'r') as f:
+ print('FIXME! cmdline file:')
+ for line in f.readlines():
+ print(line)
+
+
def main():
# Report modes:
# * verbose mode for
help='print security hardening preferences for the selected architecture')
parser.add_argument('-c', '--config',
help='check the kernel kconfig file against these preferences')
+ parser.add_argument('-l', '--cmdline',
+ help='check the kernel cmdline file against these preferences')
parser.add_argument('-m', '--mode', choices=report_modes,
help='choose the report mode')
args = parser.parse_args()
if args.config:
if mode != 'json':
print('[+] Kconfig file to check: {}'.format(args.config))
+ if args.cmdline:
+ print('[+] Kernel cmdline file to check: {}'.format(args.cmdline))
arch, msg = detect_arch(args.config, supported_archs)
if not arch:
populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig')
populate_with_data(config_checklist, kernel_version, 'version')
+ if args.cmdline:
+ # add relevant cmdline checks to the checklist
+ add_cmdline_checks(config_checklist, arch)
+
+ # populate the checklist with the parsed kconfig data
+ parsed_cmdline_options = OrderedDict()
+ parse_cmdline_file(parsed_cmdline_options, args.cmdline)
+ populate_with_data(config_checklist, parsed_cmdline_options, 'cmdline')
+
# now everything is ready for performing the checks
perform_checks(config_checklist)
print_checklist(mode, config_checklist, True)
sys.exit(0)
+ elif args.cmdline:
+ sys.exit('[!] ERROR: checking cmdline doesn\'t work without checking kconfig')
if args.print:
if mode in ('show_ok', 'show_fail'):
sys.exit('[!] ERROR: wrong mode "{}" for --print'.format(mode))
arch = args.print
add_kconfig_checks(config_checklist, arch)
+ add_cmdline_checks(config_checklist, arch)
if mode != 'json':
print('[+] Printing kernel security hardening preferences for {}...'.format(arch))
print_checklist(mode, config_checklist, False)